Malware Analysis Report

2024-11-16 12:23

Sample ID 240315-x8kv1ahb41
Target ADZP 20 Complex.vbs
SHA256 d6607a9ec5fc0698f50382ffe61a4ad1f36a8b26c0834c305f40e41647980668
Tags
discovery exploit persistence spyware stealer
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

SHA256

d6607a9ec5fc0698f50382ffe61a4ad1f36a8b26c0834c305f40e41647980668

Threat Level: Likely malicious

The file ADZP 20 Complex.vbs was found to be: Likely malicious.

Malicious Activity Summary

discovery exploit persistence spyware stealer

Possible privilege escalation attempt

Reads user/profile data of web browsers

Checks computer location settings

Modifies file permissions

Adds Run key to start application

Drops autorun.inf file

Drops file in System32 directory

Drops file in Windows directory

Enumerates physical storage devices

Kills process with taskkill

Views/modifies file attributes

Suspicious use of AdjustPrivilegeToken

Gathers network information

Modifies registry class

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-15 19:31

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-15 19:31

Reported

2024-03-15 19:36

Platform

win7-20240220-en

Max time kernel

170s

Max time network

161s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

Signatures

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\Autorun.inf C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Users\Admin\Desktop\Autorun.inf C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\Autorun.inf C:\Windows\System32\cmd.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\System32\Twain_20.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\Twain_20.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\Twain_20.dll C:\Windows\System32\cmd.exe N/A

Enumerates physical storage devices

Gathers network information

Description Indicator Process Target
N/A N/A C:\Windows\system32\ipconfig.exe N/A
N/A N/A C:\Windows\system32\ipconfig.exe N/A

Kills process with taskkill

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\taskkill.exe N/A
N/A N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2184 wrote to memory of 2496 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\cmd.exe
PID 2184 wrote to memory of 2496 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\cmd.exe
PID 2184 wrote to memory of 2496 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\cmd.exe
PID 2496 wrote to memory of 2492 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\certutil.exe
PID 2496 wrote to memory of 2492 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\certutil.exe
PID 2496 wrote to memory of 2492 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\certutil.exe
PID 2496 wrote to memory of 2672 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2672 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2672 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2656 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2656 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2656 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2640 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2496 wrote to memory of 2640 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2496 wrote to memory of 2640 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2496 wrote to memory of 2636 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2636 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2636 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2496 wrote to memory of 2724 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\reg.exe
PID 2496 wrote to memory of 2724 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\reg.exe
PID 2496 wrote to memory of 2724 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\reg.exe
PID 2496 wrote to memory of 1220 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\reg.exe
PID 2496 wrote to memory of 1220 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\reg.exe
PID 2496 wrote to memory of 1220 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\reg.exe
PID 2636 wrote to memory of 812 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2636 wrote to memory of 812 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2636 wrote to memory of 812 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 2496 wrote to memory of 240 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 2496 wrote to memory of 240 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 2496 wrote to memory of 240 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 2496 wrote to memory of 292 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2496 wrote to memory of 292 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2496 wrote to memory of 292 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\taskkill.exe
PID 2496 wrote to memory of 1552 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\attrib.exe
PID 2496 wrote to memory of 1552 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\attrib.exe
PID 2496 wrote to memory of 1552 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\attrib.exe
PID 2496 wrote to memory of 2152 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2496 wrote to memory of 2152 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2496 wrote to memory of 2152 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2496 wrote to memory of 1964 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2496 wrote to memory of 1964 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2496 wrote to memory of 1964 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2496 wrote to memory of 1088 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2496 wrote to memory of 1088 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2496 wrote to memory of 1088 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2580 wrote to memory of 2660 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\cmd.exe
PID 2580 wrote to memory of 2660 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\cmd.exe
PID 2580 wrote to memory of 2660 N/A C:\Windows\System32\WScript.exe C:\Windows\System32\cmd.exe
PID 2660 wrote to memory of 2696 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\certutil.exe
PID 2660 wrote to memory of 2696 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\certutil.exe
PID 2660 wrote to memory of 2696 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\certutil.exe
PID 2660 wrote to memory of 2708 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2660 wrote to memory of 2708 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2660 wrote to memory of 2708 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2660 wrote to memory of 2836 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2660 wrote to memory of 2836 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2660 wrote to memory of 2836 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2660 wrote to memory of 1316 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2660 wrote to memory of 1316 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2660 wrote to memory of 1316 N/A C:\Windows\System32\cmd.exe C:\Windows\System32\WScript.exe
PID 2660 wrote to memory of 2128 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2660 wrote to memory of 2128 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2660 wrote to memory of 2128 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe
PID 2660 wrote to memory of 1268 N/A C:\Windows\System32\cmd.exe C:\Windows\system32\reg.exe

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\System32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\TempShingapi.sk.bat" "

C:\Windows\system32\certutil.exe

certutil -decode x.bin ADZP-20-Complex.bat

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\verclsid.exe

"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ADZP 20 Complex.vbs"

C:\Windows\System32\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\TempShingapi.sk.bat" "

C:\Windows\system32\certutil.exe

certutil -decode x.bin ADZP-20-Complex.bat

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\ErrorCritico.vbs"

Network

N/A

Files

C:\Users\Admin\AppData\Local\TempShingapi.sk.bat

MD5 977b003963e42262994223bfb827d610
SHA1 c357ccea26f64da9ad5c3bf96b83e12ccaeb916e
SHA256 d7a449acbcb78e0fb137a868d2c8b4e86f32d643cde7e7f291f77e5480ae2bb8
SHA512 99e3dadeebc8c35c6a47a0c7de4e82dbd558f5c23df910ff6899537f3ae370c4c5ea125353cb22ae469a332dfec14577a06ae651309405ef2e69ea000ff18e6d

C:\Users\Admin\AppData\Local\Temp\x.bin

MD5 2e40c97f7790fed7606c2ab881340ce5
SHA1 b45ccff0eaffed71c822b8ad31bf2342e5aaa2cb
SHA256 299fedc96d0eaf4f1bf6398fb9c8d30b1f3f10571e834b93432bb02297b0648f
SHA512 339a2e2e931890628aee8e708a8f5d2057e8ca3a40c48689852867d99d1c56ee926f192ab3893201823ce25b0174384fcbf1e1fe7567eb11beed3babcd8e7b53

C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

MD5 591700c81fbd38cf8c83092030536c14
SHA1 a122ca4b91ec2275400e10f21093c43186391c97
SHA256 29415d32850d821d9854bfd6edabee920052e0920e6eceec187ea57b8a3c707e
SHA512 ae3e1ffef5a82016f13fe728a8a3f2696ed55cdd9ea60d6e75352d55f95fe71cb09bad02945601d4661818473882cc4fae4493d9125e3803054e69c861a97758

C:\Windows\System32\Twain_20.dll

MD5 36deca5bd53f31d062d07c1d3fa0cc8d
SHA1 1d245de03d3725b180f572b15036cbb168445edf
SHA256 d6607a9ec5fc0698f50382ffe61a4ad1f36a8b26c0834c305f40e41647980668
SHA512 e1253113a5dfd1cd7e93dfe45649d89e072db432b1724aaf36c7b082b38e770c4755e4d01c136134bb9356f74daa1e7205e5fa43f575edb5013a91f738be71c1

C:\Users\Admin\AppData\Local\Temp\Taskdl.bat

MD5 0c998e3681eb9f67fbacda38281c5fa7
SHA1 bd3e89780f374c54c5dfbe3fab83a926ca5803de
SHA256 3c656f47268598c5bbe3ee4661b4f8c7dc09420cf393a6e417541db3c6020205
SHA512 11e3fd1d141bd23a2b0f17665f0f57e5a606fdd82555a7bd88cd533863ce4269d8395f8963d1cdfde93efbb0817486db48c3b593f8de35e150e2395daadb762e

C:\Users\Admin\AppData\Local\Temp\Informacion.vbs

MD5 72946942abf5cf295f726b816c531ebf
SHA1 8ac5ccae8003c3776c2e0ee0959a76c8bc913495
SHA256 d9fc0446467e00e640f0dd0bf36882943a6993dcc1038ba8f73239152896eb25
SHA512 2f42b10e2c1359a690e1a69e307008e3beb4712e4c071d916fb1380c61cb2ed3ae48c86af44c6f1c9d613e85dd75d8cfd66fd01de0649444ee6d5193d9789d23

C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs

MD5 11aa52a7eca2cf8fdcd1584b5a8b6026
SHA1 01ae6066e6b3879cb0caf306cc91077b7c0bea1e
SHA256 8dfd0a6db2df60455840dbbbcc4f8b70d730ba1c2afbf300316898b3dd3e9b11
SHA512 07f37c050eb59e7a1a228ca851d05ca9b62bb3de97f988fb36c374c827833c8c551e5cb51eb05130861c0b35515ca77ae667ca97ee4f08c86cdf9f6fb64533c5

C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs

MD5 888e64c554686bbbc0499057cce1af36
SHA1 5a7f51c66e3ae7dd0e0231c9817aee8c9fc54006
SHA256 616cf19739e00c69e9606d9c94869f6fcb6a7b3860e7b8af9bc896f3081dad0d
SHA512 9882375fdd09d489258447d49b8b63d0bc8db57cdb7186500c00c79d57f30af5f37a69e8fab70683a7c9d730e3484ef537ee57bb1892a84f92e9aba639d1d227

C:\Users\Admin\AppData\Local\Temp\Autorun.inf

MD5 b39df423c6e5978065a9a8ec4879a3b4
SHA1 96441a7a7d8090f7a96a1160f539531f66568e88
SHA256 12a5135510016abcfe1192aceb6fec42634346661d778d68be1debaa3d75e967
SHA512 2d583fcae1ec73f836c5b66b8b1337bb4250a8230073de96d501a4fab5f522b75599ac2a1fcf1457a841d8c84bcccb88feade82f49357b28345c63d9526cfeb4

C:\Users\Admin\AppData\Local\Temp\Taskse.exe

MD5 075cd5a422cf39e1f3519748ff621c06
SHA1 5855b460686fe94fae6a7a1655311594b45e8c56
SHA256 ac328ab7996bc86f1ac48e46939f21f1dc837e44d4db9fce7ad1ee506cfcaee5
SHA512 d413ad35c3db6f8279d7736c229d380501c4daec291ebe5fc49086289ce7a3a8e33e09c2a5af175c4d82c2b17462f7293f5f3508f393c98d86f2c69d97b0d516

C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat

MD5 cfb046d3c9513b92c1b287da26f97c28
SHA1 ea8208c4dad826b7fdb3b5b728863a95e86d4383
SHA256 a06f170d4f92bf290e38b0ce1c05bb59c95de2797b1a5253b949ad7e1be9818b
SHA512 dbeeea4d284f59e1455a5426334caa02458e88833aeece9817c51be616697ca4c399b2a9d0e8e44bf4a5ee63d0b37c0aed68c01f1748fa5a23ed6d2af62b3340

C:\Users\Admin\Desktop\Twain_20.cmd

MD5 401e4eb249071b70f56d18e942ae7df2
SHA1 f3820c8c3ecf2443504736023fc0ce252d06e19c
SHA256 33413957207bff35858e95b3d8a54bf2b9e7d20882a4a62366946cfd960dbe73
SHA512 196e7ef12447e97e3be7a7c20fd69d0d1377364def9059e8eacf05a98a003fdc0470c9e88f662d38db7c54c24135d165bbe59f32b49aaeba5e91e6941725edf6

C:\Users\Admin\Desktop\Taskse.exe

MD5 1170a7ca71a1d14545194556be72c379
SHA1 79f9088bc37cceec555ee8761fa9bab1308728de
SHA256 25bf7f7c9b1469e2e5ebedb693c2e264cec0cd4b0518ec6213a235b430750b27
SHA512 e9350eeb777288a3c98c0391b23aec2d04d2fa9575d4f32b5e193a6bb0da58fa0281519fbb6dbceb6bcd035e78f19b6870686bcc19965678f43b557cf52dbf93

Analysis: behavioral2

Detonation Overview

Submitted

2024-03-15 19:31

Reported

2024-03-15 19:36

Platform

win10v2004-20240226-en

Max time kernel

19s

Max time network

281s

Command Line

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Windows\system32\cmd.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation C:\Windows\System32\WScript.exe N/A

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Twain_20 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Twain_20.cmd" C:\Windows\system32\reg.exe N/A

Drops autorun.inf file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Local\Temp\Autorun.inf C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\Autorun.inf C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\Autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\Autorun.inf C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\Autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\Autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\Autorun.inf C:\Windows\system32\cmd.exe N/A
File opened for modification C:\Users\Admin\AppData\Local\Temp\Autorun.inf C:\Windows\system32\attrib.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\Twain_20.dll C:\Windows\system32\cmd.exe N/A
File opened for modification C:\Windows\System32\Twain_20.dll C:\Windows\system32\cmd.exe N/A
File opened for modification C:\Windows\System32\Twain_20.dll C:\Windows\system32\cmd.exe N/A
File opened for modification C:\Windows\System32\Twain_20.dll C:\Windows\system32\cmd.exe N/A
File created C:\Windows\System32\Twain_20.dll C:\Windows\system32\cmd.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\system32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\system32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\system32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\system32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\system32\mspaint.exe N/A
File opened for modification C:\Windows\Debug\WIA\wiatrace.log C:\Windows\system32\mspaint.exe N/A

Enumerates physical storage devices

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\calc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\explorer.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\calc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\calc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\cmd.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\calc.exe N/A
Key created \REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000_Classes\Local Settings C:\Windows\system32\calc.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\takeown.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\taskkill.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4128 wrote to memory of 6140 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\cmd.exe
PID 4128 wrote to memory of 6140 N/A C:\Windows\System32\WScript.exe C:\Windows\system32\cmd.exe
PID 6140 wrote to memory of 4948 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 6140 wrote to memory of 4948 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\certutil.exe
PID 6140 wrote to memory of 4864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 6140 wrote to memory of 4864 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 6140 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 6140 wrote to memory of 2204 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 6140 wrote to memory of 4984 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 4984 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 6140 wrote to memory of 384 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 6140 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 6140 wrote to memory of 4704 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 6140 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 6140 wrote to memory of 2964 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 6140 wrote to memory of 5916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 6140 wrote to memory of 5916 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\ipconfig.exe
PID 384 wrote to memory of 6132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 384 wrote to memory of 6132 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\takeown.exe
PID 6140 wrote to memory of 1572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 6140 wrote to memory of 1572 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\taskkill.exe
PID 6140 wrote to memory of 640 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 640 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 3328 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 3328 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 5008 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 5008 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 2632 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 3528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 3528 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 1940 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 1940 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 3956 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 3956 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 4112 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 4112 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 5276 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 5276 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 5332 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 5332 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 904 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 904 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WScript.exe
PID 6140 wrote to memory of 2516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\msg.exe
PID 6140 wrote to memory of 2516 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\msg.exe
PID 6140 wrote to memory of 1000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\msg.exe
PID 6140 wrote to memory of 1000 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\msg.exe
PID 6140 wrote to memory of 556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\msg.exe
PID 6140 wrote to memory of 556 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\msg.exe
PID 6140 wrote to memory of 464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 6140 wrote to memory of 464 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 6140 wrote to memory of 3520 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\notepad.exe
PID 6140 wrote to memory of 3520 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\notepad.exe
PID 6140 wrote to memory of 2092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\calc.exe
PID 6140 wrote to memory of 2092 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\calc.exe
PID 6140 wrote to memory of 4260 N/A C:\Windows\system32\cmd.exe C:\Windows\explorer.exe
PID 6140 wrote to memory of 4260 N/A C:\Windows\system32\cmd.exe C:\Windows\explorer.exe
PID 6140 wrote to memory of 6080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mspaint.exe
PID 6140 wrote to memory of 6080 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\mspaint.exe
PID 6140 wrote to memory of 6024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 6140 wrote to memory of 6024 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\cmd.exe
PID 6140 wrote to memory of 2708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\notepad.exe
PID 6140 wrote to memory of 2708 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\notepad.exe

Processes

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempShingapi.sk.bat" "

C:\Windows\system32\certutil.exe

certutil -decode x.bin ADZP-20-Complex.bat

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\msg.exe

msg * Has Sido Hackeado!

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"

C:\Windows\system32\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\msg.exe

msg * Has Sido Hackeado!

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\msg.exe

msg * Has Sido Hackeado!

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\msg.exe

msg * Has Sido Hackeado!

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\certutil.exe

certutil -encode "C:\Windows\System32\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\certutil.exe

certutil -encode "C:\Windows\System32\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll"

C:\Windows\system32\certutil.exe

certutil -encode "C:\Windows\System32\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll"

C:\Windows\system32\certutil.exe

certutil -encode "C:\Windows\System32\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\certutil.exe

certutil -decode "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\system32\certutil.exe

certutil -decode "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\certutil.exe

certutil -encode "C:\Windows\System32\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll"

C:\Windows\system32\certutil.exe

certutil -encode "C:\Windows\System32\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll"

C:\Windows\system32\certutil.exe

certutil -decode "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\system32\certutil.exe

certutil -decode "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\system32\certutil.exe

certutil -encode "C:\Windows\System32\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempShingapi.sk.bat" "

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempShingapi.sk.bat" "

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"

C:\Windows\system32\certutil.exe

certutil -decode x.bin ADZP-20-Complex.bat

C:\Windows\system32\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"

C:\Windows\system32\certutil.exe

certutil -decode x.bin ADZP-20-Complex.bat

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\msg.exe

msg * Has Sido Hackeado!

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\msg.exe

msg * Has Sido Hackeado!

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\system32\msg.exe

msg * Has Sido Hackeado!

C:\Windows\system32\msg.exe

msg * Has Sido Hackeado!

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\notepad.exe

notepad

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\notepad.exe

notepad

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Twain_20 /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd"

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\certutil.exe

certutil -decode "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\system32\certutil.exe

certutil -decode "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\certutil.exe

certutil -decode "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\msg.exe

msg * Has Sido Hackeado!

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\certutil.exe

certutil -decode "C:\Users\Admin\AppData\Local\Temp\Twain_20.dll" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\system32\calc.exe

calc

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ADZP 20 Complex.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\TempShingapi.sk.bat" "

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\icacls.exe

icacls "C:\Windows\System32" /reset /t /c /q

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\msg.exe

msg * Has Sido Hackeado!

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\notepad.exe

notepad

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Twain_20.cmd

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Informacion.vbs"

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K Taskdl.bat

C:\Windows\system32\reg.exe

reg add hkey_local_machinesoftwaremicrosoftwindowscurrentversionrun /v WINDOWsAPI /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\reg.exe

reg add hkey_current_usersoftwaremicrosoftwindowscurrentversionrun /v CONTROLexit /t reg_sz /d c:windowswimn32.bat /f

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\system32\taskkill.exe

taskkill /im DiskPart /f

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\ipconfig.exe

ipconfig /release

C:\Windows\system32\msg.exe

msg * Virus Detectado

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\msg.exe

msg * Has Sido Hackeado!

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\attrib.exe

attrib -r -a -s -h *.*

C:\Windows\system32\takeown.exe

takeown /f "C:\Windows\System32" /r

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\notepad.exe

notepad

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\calc.exe

calc

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs"

C:\Windows\system32\notepad.exe

notepad

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\msg.exe

msg * Has Sido Hackeado!

C:\Windows\System32\WScript.exe

"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs"

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\attrib.exe

attrib -r -a -s -h "C:\Program Files"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\mspaint.exe

mspaint.exe

C:\Windows\system32\calc.exe

calc

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\calc.exe

calc

C:\Windows\system32\format.com

format /y /q F:

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\notepad.exe

notepad

C:\Windows\explorer.exe

explorer.exe

C:\Windows\system32\notepad.exe

notepad

C:\Windows\system32\mspaint.exe

mspaint.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
US 8.8.8.8:53 241.154.82.20.in-addr.arpa udp
US 8.8.8.8:53 67.179.17.96.in-addr.arpa udp
US 8.8.8.8:53 41.110.16.96.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 18.134.221.88.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 247.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 5.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\TempShingapi.sk.bat

MD5 977b003963e42262994223bfb827d610
SHA1 c357ccea26f64da9ad5c3bf96b83e12ccaeb916e
SHA256 d7a449acbcb78e0fb137a868d2c8b4e86f32d643cde7e7f291f77e5480ae2bb8
SHA512 99e3dadeebc8c35c6a47a0c7de4e82dbd558f5c23df910ff6899537f3ae370c4c5ea125353cb22ae469a332dfec14577a06ae651309405ef2e69ea000ff18e6d

C:\Users\Admin\AppData\Local\Temp\x.bin

MD5 2e40c97f7790fed7606c2ab881340ce5
SHA1 b45ccff0eaffed71c822b8ad31bf2342e5aaa2cb
SHA256 299fedc96d0eaf4f1bf6398fb9c8d30b1f3f10571e834b93432bb02297b0648f
SHA512 339a2e2e931890628aee8e708a8f5d2057e8ca3a40c48689852867d99d1c56ee926f192ab3893201823ce25b0174384fcbf1e1fe7567eb11beed3babcd8e7b53

C:\Users\Admin\AppData\Local\Temp\ADZP-20-Complex.bat

MD5 591700c81fbd38cf8c83092030536c14
SHA1 a122ca4b91ec2275400e10f21093c43186391c97
SHA256 29415d32850d821d9854bfd6edabee920052e0920e6eceec187ea57b8a3c707e
SHA512 ae3e1ffef5a82016f13fe728a8a3f2696ed55cdd9ea60d6e75352d55f95fe71cb09bad02945601d4661818473882cc4fae4493d9125e3803054e69c861a97758

C:\Users\Admin\AppData\Local\Temp\Twain_20.dll

MD5 36deca5bd53f31d062d07c1d3fa0cc8d
SHA1 1d245de03d3725b180f572b15036cbb168445edf
SHA256 d6607a9ec5fc0698f50382ffe61a4ad1f36a8b26c0834c305f40e41647980668
SHA512 e1253113a5dfd1cd7e93dfe45649d89e072db432b1724aaf36c7b082b38e770c4755e4d01c136134bb9356f74daa1e7205e5fa43f575edb5013a91f738be71c1

C:\Users\Admin\AppData\Local\Temp\Informacion.vbs

MD5 72946942abf5cf295f726b816c531ebf
SHA1 8ac5ccae8003c3776c2e0ee0959a76c8bc913495
SHA256 d9fc0446467e00e640f0dd0bf36882943a6993dcc1038ba8f73239152896eb25
SHA512 2f42b10e2c1359a690e1a69e307008e3beb4712e4c071d916fb1380c61cb2ed3ae48c86af44c6f1c9d613e85dd75d8cfd66fd01de0649444ee6d5193d9789d23

C:\Users\Admin\AppData\Local\Temp\Taskdl.bat

MD5 0c998e3681eb9f67fbacda38281c5fa7
SHA1 bd3e89780f374c54c5dfbe3fab83a926ca5803de
SHA256 3c656f47268598c5bbe3ee4661b4f8c7dc09420cf393a6e417541db3c6020205
SHA512 11e3fd1d141bd23a2b0f17665f0f57e5a606fdd82555a7bd88cd533863ce4269d8395f8963d1cdfde93efbb0817486db48c3b593f8de35e150e2395daadb762e

C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs

MD5 11aa52a7eca2cf8fdcd1584b5a8b6026
SHA1 01ae6066e6b3879cb0caf306cc91077b7c0bea1e
SHA256 8dfd0a6db2df60455840dbbbcc4f8b70d730ba1c2afbf300316898b3dd3e9b11
SHA512 07f37c050eb59e7a1a228ca851d05ca9b62bb3de97f988fb36c374c827833c8c551e5cb51eb05130861c0b35515ca77ae667ca97ee4f08c86cdf9f6fb64533c5

C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs

MD5 888e64c554686bbbc0499057cce1af36
SHA1 5a7f51c66e3ae7dd0e0231c9817aee8c9fc54006
SHA256 616cf19739e00c69e9606d9c94869f6fcb6a7b3860e7b8af9bc896f3081dad0d
SHA512 9882375fdd09d489258447d49b8b63d0bc8db57cdb7186500c00c79d57f30af5f37a69e8fab70683a7c9d730e3484ef537ee57bb1892a84f92e9aba639d1d227

C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat

MD5 cfb046d3c9513b92c1b287da26f97c28
SHA1 ea8208c4dad826b7fdb3b5b728863a95e86d4383
SHA256 a06f170d4f92bf290e38b0ce1c05bb59c95de2797b1a5253b949ad7e1be9818b
SHA512 dbeeea4d284f59e1455a5426334caa02458e88833aeece9817c51be616697ca4c399b2a9d0e8e44bf4a5ee63d0b37c0aed68c01f1748fa5a23ed6d2af62b3340

C:\Users\Admin\AppData\Local\Temp\Taskse.exe

MD5 74ec21b425eff756ffb79bb71899868a
SHA1 f22c6bd6f281267867a0a85bd0b8d3bd865f59cc
SHA256 00cf24dd747092ccf091aff6dd5912eed3848b4d30e57bdcbf0cea0fcaae386f
SHA512 ef3010ea4a79731d6e3a42a8ea1061dde5a77940e41f4657aa6f7c9dbf197062499948664bf27b330256f0649363c337e873b0027e9e09fa2630541ed76223ba

C:\Users\Admin\AppData\Local\Temp\Autorun.inf

MD5 b39df423c6e5978065a9a8ec4879a3b4
SHA1 96441a7a7d8090f7a96a1160f539531f66568e88
SHA256 12a5135510016abcfe1192aceb6fec42634346661d778d68be1debaa3d75e967
SHA512 2d583fcae1ec73f836c5b66b8b1337bb4250a8230073de96d501a4fab5f522b75599ac2a1fcf1457a841d8c84bcccb88feade82f49357b28345c63d9526cfeb4

C:\Users\Admin\AppData\Local\Temp\Taskse.exe

MD5 e0bb7f61366441f343ae925b346f466a
SHA1 fcb9881960f0ea63c99a0f834c62bf693f7eab3c
SHA256 d91947763c4edbaed5562368b6fdd1ad7f0de6777a2710dd191b42ca1958b4bb
SHA512 d0d264f47f22cdb895bbc060b5db1180b60f526e34ebd67fedbea7821f3eb2ac3213206617eb307ca71de3b6034ffb0e69492124f1538cae42209f40ab8cc20f

C:\Users\Admin\AppData\Local\Temp\Taskse.exe

MD5 4526444b415f58a0135e9477e94cc28b
SHA1 b5b60d9b8a24f4957feb075eee14f68156aba88e
SHA256 5e76819dd38b6ddaab4d8169e19d10966457c8bcc2d0599885e30baeaf021879
SHA512 dade9580cc8f13566d96544916b0326614dbe862a10b943529400561d7973fa2023c2a695d5dd6ed60f9aa8c30631e45da07a373375590610899bc3dff39536e

C:\Users\Admin\AppData\Local\Temp\Autorun.inf

MD5 05a4d4594b598cfe885bf862787b8cde
SHA1 dfb26e156e88af25bd00db0bc788b81c521a4db9
SHA256 fd8427db8c0c5ad2c7a8fc36c18f9400e25bdd7dfd1d267ec11a7a94bdbd1cab
SHA512 ac1f87eabd69e1939f463c8710cdd1ba8a886ad6509d26d0fac4e09ab82056cf952b7a0cf2ecb55bb0549fdb0aff6457133eeb6b7b222df58f773f91df101136

C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs

MD5 b2206e980c51067d6e9dd7575d842bdc
SHA1 5aa6f76eee9efd569089be7f363e30ebf0531a22
SHA256 add106f3d6e9cfd2fac3d14a74d6791a9caa257b9c7e105a9a5fc2a309337ecd
SHA512 89ab3ca635f8fdcb1206f0a1d585355a730506cc1d72ca666f1e9d650b24107368349b44ab0b3d3132442a2fc61c0c9404d00b717a61f305d9c93d5d638d9bec

C:\Users\Admin\AppData\Local\Temp\Informacion.vbs

MD5 d3715d7f77349116a701484780269375
SHA1 589c48410637ac33431569b867070a51c4de5b1c
SHA256 ea0bdd86d283aba33d619aeecb5087ad9132b58e8ae7121e3c3774504abb976a
SHA512 9526a79ac4f9a18104f8e84d684136eef9b6bbccfe772d1d1030d9be02de2f7221cdee248ec748971551a42ed1d8fb1c8a9d820b837164f68376cdee1dc8ff3a

C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs

MD5 d5980bf4b018e4c397df95afe8941c66
SHA1 ce53c669a898d09479831bc59bc31a5fba2a6f2b
SHA256 9afd004a8cb9b9e8b1eeab780fb0c4ffa39c3ec2ded034b1a7cd69db7f67872a
SHA512 c995f9d3252b9a7af52a398562261baf3297fee64fade9de22895cce017e5aa097c7935a0519e474253a181e1e018348a1ade3d953bfaff5dc43e30e2d9fde5f

C:\Users\Admin\AppData\Local\Temp\Taskse.exe

MD5 8ffcbdccef276b7e7326e90d36106a8c
SHA1 2909b264ceaa8ccf5cc71cadb0755f21546bc9b2
SHA256 2b458748c8c84463f9e11f351cd95cda529585c188e1db6a7666236b5d1ce6e6
SHA512 cc060be06e30400d682077977c66a4db9807383bee9174a453e69c300500f2b9c76f2d5ec30e5e9b9f35dd03e5d2b76a781ed63def3ff380105b7d91171e7215

C:\Windows\Debug\WIA\wiatrace.log

MD5 b15b5ef5c7cdc580a31626cb6769f302
SHA1 a32b2088db70b670df943b8a8dabc3a61d26790b
SHA256 478654bf614a141724f171b6034536c76671a993121d83ba162a41f5b7420f1f
SHA512 b023b1817ff053ffd59fd124b3d21a05715be25cb68b57c8629047e7a88f7017afa41a2cb65df7351152c953143f9c8d2e7ac3de802be756fa11deac2e020dac

C:\Users\Admin\AppData\Local\Temp\Taskdl.bat

MD5 dbe5be082a79a960b3fcbf6eb15030fe
SHA1 e5a37dc79da6d18e05755b27dfab991ac400a02a
SHA256 bd55661fa1e8dba0fc5af8b3a8d554e50cf81ff7637e904ab28fe88ca52b124b
SHA512 419c5e75e5ef3e3cf74eebd7a8f3ab081b4f9a34f07d52ea9b0ce632b981b00da19db6627740de20d27850c2fbbcd08863a38285d056775105355e0301accde2

C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd

MD5 401e4eb249071b70f56d18e942ae7df2
SHA1 f3820c8c3ecf2443504736023fc0ce252d06e19c
SHA256 33413957207bff35858e95b3d8a54bf2b9e7d20882a4a62366946cfd960dbe73
SHA512 196e7ef12447e97e3be7a7c20fd69d0d1377364def9059e8eacf05a98a003fdc0470c9e88f662d38db7c54c24135d165bbe59f32b49aaeba5e91e6941725edf6

C:\Users\Admin\AppData\Local\Temp\Informacion.vbs

MD5 089381a847f01ba0962ae00f0d92d5e8
SHA1 9f3240f89871639778a318e0cadccafcf9d7c55e
SHA256 2cda289b5067c9daf8b4dffdf323b2fe9d0a47bfdbb91b4a017029bc74729c05
SHA512 89fbf1b423f17101970290b070d740b8d58beecc6723e64edb7ae23b9285afe3a612b8e8f5ec202d60aca3875a28dbc556a43af9fe4113ac0bdba1fa83c5213a

C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd

MD5 ad0010095a82da61b486dbe70cd90767
SHA1 67d5a65f8cee8409dfcec2da99d290a2730cd662
SHA256 28d651bd0e01d8ee66b46b064b05841cf33e44f3c55ee8b0612f5a812bf0de43
SHA512 93a5f5c2f71a00ce760f1efe89280e259b3f75f1d04e3a1708d683c0b9a619fb5ac577e0d9f59c3b767c3b45323e3af9450362624526705766bf77a94b4aa827

C:\Users\Admin\AppData\Local\Temp\Taskse.exe

MD5 71d71278e976eff1a71a7d2194ff1ee9
SHA1 7bc12df70dbff334e6ac57893d2966faf2fae039
SHA256 cff159d2a9accf2ff9243cc8c56b7c585e2f93798871b26fb8224d08583e9ba9
SHA512 b8556ab30f2590d8ad0944fccefc51f29a24226f24051c82c257a263cbd74bb7d18a0cbbd1a70cc917ae45641ba7c0ffa2a39243e02b0a01b34814a6fe16f2d2

C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs

MD5 7659392a12010d8c761cb9888f6fd5ac
SHA1 b8829c26628740b77ab7405c231f420e860d8c1f
SHA256 71bd0bffdeca9dce2b4e9e1d767a0732657032171f3ad33903dec353ef95a431
SHA512 5caf94b288649b687f411cbb5519168e09e161f8d9545a6bad1b0d08876a542d153a115f8b44e3f15d973812ce8ec7471bba7d8bd0b9a22d0abf6fdf2914a2bf

C:\Users\Admin\AppData\Local\Temp\Taskdl.bat

MD5 51f8c681b5c3b2107f346f9e748ee487
SHA1 3cf75c9d5862392a9366104b55b46c4e56ea6be8
SHA256 fa18d07b478aae108e25b73e5a9fa7423b23341371d40c595a60ddb2a9abe17e
SHA512 65a305605d64e7ee007b2ef60af5be5c60fb32d90de9eb99c07a1a9d840fa4730e0e9848431ba0827ac84371a4aae8fbeb640f429737b99fbca2aae59f1897af

C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs

MD5 482dcfe952218cf31ad2adddd8f6616b
SHA1 7a6bcfce28c76bc3319c871696531d21200f3bc0
SHA256 093b0f0c3f7a9bf24406662245b57f171837a266aba49f198319045e971e77d5
SHA512 440182ba5cd7c85abc11fe9097a41486469afde738d26f471efe4e7928106cd57240b1045bc97d60c42147ca25b032c4149487f1a1ab4581292c7eff2bc801b9

C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd

MD5 9905e5a33c6edd8eb5f59780afbf74de
SHA1 64b2cd0186ff6fe05072ee88e2bb54476023772e
SHA256 c134b2f85415ba5cfce3e3fe4745688335745a9bb22152ac8f5c77f190d8aee3
SHA512 e10711d0fb09db27192e9af05ae45b83cf3882d98e904a7f1f969cf24c2f9626f70f35d76f57477fe9c64a58bc74100410740e9d506d4e72d3e2900d6277816e

C:\Users\Admin\AppData\Local\Temp\Taskdl.bat

MD5 a2011942a574e5ba895baa6726ca70c4
SHA1 21fecf833dee3b88b6ba37a23ffdb4690cd10ec4
SHA256 c11912cf32ad7fe2e6267764ee9032c9ae9cc85633d0ee0768ee752e93fd1b9b
SHA512 bea4aa297a0cd79b6b214bacbc75370d1735f27329e1aa066e0ae8bfe4bcb033d3d8d585c8a1a0da2897b79c149d6e3cc7046ab4e3203862fff75617105b2e89

C:\Users\Admin\AppData\Local\Temp\Taskse.exe

MD5 524bcbe4a9e51a9a1537178cfca93055
SHA1 213caa2ba609c8bb162945b3bb1cf089b96407eb
SHA256 c401523b3570805d85505bdd765a4225ed374cc86b7faef2fb7423083b4187fa
SHA512 dfeb4bf32e8fbb5e7a53f56ce62975bb3480c38ff4e5e9a837dec00bdd5a900209d34f38f1920480d4f21f21fb1081310e45c33bb7708125954cf9012e6fee94

C:\Users\Admin\AppData\Local\Temp\Autorun.inf

MD5 b20421aba6b1738af56e402aed7b5fca
SHA1 7b9e8f147c25a383e775cf4ce66fec5f050f8187
SHA256 2b11af7c3e34fcb9851881ecb06ee601696a6e29b3d3f283f79b118bdba35ecd
SHA512 32eb6ae6c4009d43422f6abad7cd88f21b3efbd85c4a8c1fa45675f59f5c7a1d0839c6f73131522de5c0f5f1cec2dc9b4e2b00dbe68e060390cc5b6174ef9683

C:\Windows\Debug\WIA\wiatrace.log

MD5 62553b20f3bac158d9ca7a1a61828a8b
SHA1 30fcc51c821d9eddb9d856cfb291e23f8dc5100c
SHA256 0cc63a89e69a5cf9a1699653ba15e5c9663db6bebbd9a1eff3520d37e8585b98
SHA512 cc6406fbf92f9534fe8c785c11ca9065f461531780441d70f1d894e4b9420c1909c7d6dd3d29072d846b19d57446b868cf4b597c041d5d5af7e1477d05b44d90

C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs

MD5 0ba362eaaaee823cb501c677abde95ee
SHA1 62c0a0cf58c5a370cb4c11df29c09bca39b2acc1
SHA256 9e9d334fda37730b83f843e491546b1120d154f5bf7ef1b9a91f9b19552f2dfe
SHA512 53f4b154dd0fb310f42fe1a42b05faa83d0a259afff6c6c234a5a81c65b0b69e8bf2d70bbce6b4ddda4be0ad99fd4a33e306e0923459dc10f2821d2f26be79c8

C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs

MD5 2de552fef2f08103f893d46e24d1a427
SHA1 c820d3455d46ad2a2cf508ba3443707e51e313a8
SHA256 4f53d5a5b6ee0c4a7e3f4f76309eb63b53e208b07491705d1970e40570e7f0c2
SHA512 a63835d1ec26b87101d9cf2b5f9a7c16ef37315838d8cb101bb44dc221b4445e13e7f82de872fae7e4477250bf21fa53fd97a64f1a2a03b76f8cb868a0c40d74

C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs

MD5 a826bea47f92eca7dd49bca2195c6658
SHA1 773e4c06746815efbb960f885ceeb8cd5bfefc69
SHA256 92426ef6382e8f79f94e2f3cd66cfec4c06cd355224ba631b24e45ee592efbc0
SHA512 51d1f26ff1bc8b56147102ac822bf2969782ee3fc5095218ab44723fe3b1b1acaa2334d4f43e8487990d17a8bde1efbbd39b65465bbdb3ef4cf4fa356ec2ca6d

C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs

MD5 3b1ca39d624acc7a7883b544db3d1a0a
SHA1 62e9f6f2866d48879bb7b70b5b054b7cea328136
SHA256 63f14c3150677a3ca2459b97778781bd9b0174c2950bc560f1856201677f0f59
SHA512 7925876efa5e42932cda394752fcd63837c754a6d22a3c381a4456b4d9aee81470146cf94884aa13af1e3c7e86754b9eeb26d0300fd4b72d5ab8d2e5ee6946d0

C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs

MD5 410177c36598cb3a9ad5a69954a1a957
SHA1 313c664bb36c424bd537c21f010065c7aae84718
SHA256 d3fd3a6176d0f3981b179fba3c17b6c1d8a6a79e0ef05b8a5ef2334942857f61
SHA512 81ec31bfe7dc94098700e0886cfeb41302774b56005563a349632d64370e14603ea2ae4dae977f1db3b383a35f6682b7978d9da2a0e791c15a4e019b1f6f7738

C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs

MD5 ac11ecabc4e1b3d61c93f48027789618
SHA1 26064732a6978785fb210a7f842d432770f1a78a
SHA256 e75de6690f82798ba27388ec61f5682b6d4463458b8d67a25e1423eb86925a87
SHA512 7ad6d3ac32c29b4b0377e31f06e7053dea96806b0bad18edb8540270ac15af6c7fc7aa66fcedcba5e9f9fd8b2bc956af1f68b6666536d7044d8d13508ece561a

C:\Users\Admin\AppData\Local\Temp\ErrorCritico.vbs

MD5 83cb6e85a0b3b8a51b319300790a055a
SHA1 d568d474b0b8cf4b4d24c0fd5c1fdd40746b9400
SHA256 503102cf1c9c0008023c4e2eb4871c822c4162d233b5d5e0362a12eb6260e12d
SHA512 d222528e2d296930c9e585ac614635ee0b224fb25cc4abb521f4844e293e7bf5b0bbb889630d495b42881327430e12e02a96cf03adb2442f574f15fc167a11aa

C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs

MD5 99f2e933bb524dd11c9fe339f18aafa9
SHA1 ec98eb22a21349a4c140da23a306476e02a731ad
SHA256 d57568cf1481d4a2fee893ee83afc1b7a7ea3ed2d59f09a090bd07e63a285a8a
SHA512 2b13a6275733e16af098141f86463614f8697e01272e4a2d71237be3112ece31fce496ede441f5dc20a30bdd87a50a65e6f00675664bec68f521004cc50d5ddd

C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs

MD5 f9fc92f05d83794d39a5e585eaa6316d
SHA1 17d03c53e40260dd0b936420138871d3826d7d33
SHA256 0a459745222222c5aa77f80dfa89fd3584609efcdca0ce8ee45fc0d639ee92f3
SHA512 a56d26e8be34d7102d33fde85e9d76f2efbfb267167dc6fa245a6ce0d71d4d25667e6a4b2dafae69ecf83e7c142080e96d82c12d6f3ac23b8a6b5e68e713d3e0

C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs

MD5 b2f5feebabe9a12de395292a4d3744bd
SHA1 61f791c34f0a4420bbc3d59a9fab7de69065c2ef
SHA256 fbf98a433b9e1b7dff262093ed6d3c1d4c638494cfde577797288e6aa09574c4
SHA512 36cd51c00f02550148fab8db2dc0dbf705bc65489a41e706d955d0b5cdd6cfdbbd4d62ef64b4b46b4ed7596eb8bd69cdffaf950c8035b3c10ca386b340ff011a

C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs

MD5 b8abc33dc6d79b2329b4328c941c698a
SHA1 6e2eb3588effebdf2d8b42aa34f364a86025059d
SHA256 1ac6dc6a287180d6f6b859bd1f9fc327f41003456c43e2223eb81856d8fd28a0
SHA512 abf016feb4020fec96ecb6d4e1731c29533efb768da4fbb56fa340906f16191ca685c9cf25dbaa2e84c08633e9800e24a6dbe34c14ad9ad6bc2dc41858936ef3

C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs

MD5 27018d7ac81974f88821f4aa0e93ff16
SHA1 6bba3916928b9cf2eb131276750186267034c4dc
SHA256 23f86d6c9ce26eea0bfe07a45db7266f938bb9e5e3c3dd44ccdd5419b612298a
SHA512 c27feed99afede1c24a63363640c55ea7879142143005c332656fe02e4a17c40b84bb269db5616d6fcfc72ea036133a7cfb0d2a7188c8637ba02b56b48cb47d5

C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs

MD5 fae70694ff77baeb980d0db785e8c8ea
SHA1 fdcffcc0d72e97c70190eba474e0bc9c8276dc6e
SHA256 248e5ac975be2258ce392e264ad8d97bc14f3eb1a5704034090eecf30f965c50
SHA512 ca23b4cabc7c733d99bb635b4a9581df7884336862a28f0fc468c23eb43693fefd57b6d934f8a7c60a14ecd6d72b723d3d87749f278cd73efbcb91d31b3820a0

C:\Users\Admin\AppData\Local\Temp\Advertencia.vbs

MD5 d5e4f68f85a9456fd0ee2a7c15a4f75e
SHA1 10d683fd909e2c55980d22381ef6eaceda14e1c9
SHA256 03059ca57bccd4f82681e13dd675fc721c11af751c22f564fc274e52c9a91a28
SHA512 377ccc8aae0bac6550b3f683cfc29087eded4a64adc4b508a4a2daae23894a6cba71158254c1b0166393c27f4db7ecb7bb8ae0afc30c816eda610e506dfbb349

C:\Users\Admin\AppData\Local\Temp\Informacion.vbs

MD5 942406172179b9d3b64cbfcf8285b7b7
SHA1 34e6ece5008d83f4669403dea616a99e10978d44
SHA256 88fe85a2a6fd64811dbe501f89fad74f111f0cbc1b9409e574610832cce79fc9
SHA512 9b7411c5046ddf085e02df144a8b77bdd6ffe4f774e0a23cfa48a29fe6529516ad5965b4a42f82e51092dd8df00b7f022f1d6217baebedf0b34313779da5f75a

C:\Users\Admin\AppData\Local\Temp\Informacion.vbs

MD5 034c9e63a8f2214297e549abce8aa586
SHA1 065821ee41886afa2b0e10fad0b943f62d8ee3ce
SHA256 7b1067db22e3e631087258302ecd5341b9b0d94df68a78bb43e9f387dc5126cc
SHA512 4716400b0fd16092a1f2125e3711056f96a1ca6a059525a4c5e324244e23bbeb99de23f1cfcafbbcc4304b5a8ccde1afb394f983241eada5c160b57b425b758f

C:\Users\Admin\AppData\Local\Temp\Informacion.vbs

MD5 e122af4a2f2b2a0f9b835ccd537f8a55
SHA1 fedafa041006a6902750937681e6835fd37a5147
SHA256 f8cce09107b231110d891470f532311f6f4459a930e0582ffa52dfa5e1b570da
SHA512 f9b644da31107858a5c87568d945c17c3e2c6636a7daa754efadb5554dbff6779d2ba71a028abeae08ba36d222111a330ef2588606427ff67b5f2e2c53b41421

C:\Users\Admin\AppData\Local\Temp\Informacion.vbs

MD5 dea06c7af50f313b5870f259d4abc97d
SHA1 c97db78000541a14f2de9f9af73ba06d0c137c07
SHA256 acc8b9a93cf1219233a1fd74af7de7e484c4a504be808b64a078fac5238f3c21
SHA512 d1f39034fb6260b3909aac37b370d013dbae59f97f4bceeda79d72a3dfae219daa9b1d5e7e94815821b587e3905d9db63d7b9165fdc893ca4fe756af96a34700

C:\Users\Admin\AppData\Local\Temp\Taskdl.bat

MD5 f21469d87280b0fb6ef2bc5e0782dccb
SHA1 8a4cf406ffcc4619b9e366297acf74da88a8393c
SHA256 0b6ba837f2ca3db9be97cc8c1ca20cd1703f507fcc16568ed6941f4e60978042
SHA512 b54161efd6ff800ffe55f4c19c9ae5fc094fff1df4c25eae77cbb4dbd20dac9c17937194be9cd5e2d5eccd4c1cd0d85098ef88dd3c783d9ae479f16e57545ffc

C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd

MD5 72693c25674d3244e9415f1130e7d7d0
SHA1 a874790e3213d9f2d6da5cbb18e0ce7faaca984b
SHA256 9ac2e2a7f5d83f670543bd123f68e3aad482b0c165e7e797c65fb9f8700ee1b5
SHA512 ea3596bdb807811107ad2ef5a626decb06c8c991e25e350f472f4d33062f0e05c6404de32791864776a7897526c878466737c99cc3ceadba1973f8d5d69fdb42

C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat

MD5 fe669e0a3a56961fba38ef9b7f7d01dd
SHA1 338b6f4a3ec71587d53aec450ca5448928f966a1
SHA256 138b48a413afa60daa506090fa4332d913a1f9d895b6c289c36dd7db00019d64
SHA512 ff0bc50cef59421253578172602a56f9f9b3a8988a16576eaf8a004792d330c708dbed95f5f4074fb2eec36d7df7f4a0392c88420d2b0678cd907056a23cd41b

C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd

MD5 0eafc7e411bc95b074c8ea60b00b1f6c
SHA1 7a63173a486dd28e4159716b19b0ff838a6bfae1
SHA256 45b48741270f8f74abbb703bf41496ae1a447ce659cee66e4583e6f96e82617a
SHA512 fb71f2f1d0e05202420a1426f8e5d509f645a613c2d20d64c5d78a559f0bca7f8067e9be4665c6c2a21e7c3aa836238872430903ebd821063e1bcfbb38d404a4

C:\Users\Admin\AppData\Local\Temp\Taskdl.bat

MD5 a51fcc9209f01d597c983a5384760a58
SHA1 304c948136b3705a7d48dc86812c43335615c70d
SHA256 181fea1a2be88eea5dadf3eedad72c08254a1405dfb9aac32ed5536a78a4f457
SHA512 317979cfd3cb4e997d1763d373e4b3e337b8fa11b185b63aeb987f95cfdb2c7c4cd523aa35666284db3c3ab9f1bd9605fd15443fef99041b83f475146c19bfb2

C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd

MD5 ce46666974f1f7df7a675cd11f91a55d
SHA1 57727418fb3430e0ee1697a09d2e7bf35d8455ea
SHA256 b69cfdd69d97ffc6b541cdec0b73ce6d28665c6dbd027125a7b1aed3dc9733dc
SHA512 a78002e8f8f5cdbba772998c1f32babafd2ddf6b55c2964b64308e222a2155e3778637be20564aa8497aa1cebe33066139c516526818461e35ab5539f6a70540

C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd

MD5 8babd49ad88f1c33447d75684f86a1c2
SHA1 ff260cc000a8b1c408e6052d0dbdd0f67099e79b
SHA256 b84bcc3e91e860353deb1f1b4d205723757b504845fcccca69f54f0409106f8d
SHA512 4a0d0659954f369658fd717e034a803af631e90938a82271fb2c0fc1cd63b4adcd6de142249682cc5a2e376893af106adb92b251aa610f0d049fc97715be214c

C:\Users\Admin\AppData\Local\Temp\Taskdl.bat

MD5 4747c2ec4e74d5297fbb874f6c0d0fcd
SHA1 fc4dfd126ef920948cae17e90599371fe26428ec
SHA256 529739f3edb6a5fae1302c05070f2e1e6d1d5e96f0553e488c9dee8c26d527d3
SHA512 ddbc1a42bd1fff4c140b55f84dc70e9e7642012c01bbfe1c0e73cf0f91b2cd3d0662108ed7479561ebe6a3b6633c8495d4ec3b89e4325d537c4f5c2dce1ce959

C:\Users\Admin\AppData\Local\Temp\windowswimn32.bat

MD5 ea260c435f9eb83e2b5041e734ff3598
SHA1 ca70d64367cbdffbbf24e82baff4048119203a2e
SHA256 3ade659fdae17c11c3f42b712f94045691fbd0b413428b73e1de8fe699e74615
SHA512 548624cc523aeb4136376f792d23b3f2aee4a676362f8a0dd0e8161f0df87ab926b82f67fc174eb5d9473c23f49e6ca962bc84479967f7e624250d94efa66876

C:\Users\Admin\AppData\Local\Temp\Taskdl.bat

MD5 c9b7e3daf14c138606e12ae5691f0b59
SHA1 f9d9e04835e55fda8d94075542f673620a009ecf
SHA256 6b39e19d1288a719789cdfdc90da3aafe4b28b23b08b1b431cfb59d1f3e1cf32
SHA512 32a159e0157fcb7a10f7e65e69fcb3593b2fb26f831cd9cabc1567e840237ec35c8ea59b50b80917aa0d41da638fe8606caf7698cd446f3ebd24d2ed1e13f154

C:\Users\Admin\AppData\Local\Temp\Twain_20.cmd

MD5 75d8a7a60a050629ea19efd1d1ca2352
SHA1 6b4b84f6b4549f6bcaab1a65ec261af49bc28739
SHA256 87f6caa3026159a406e44a75978db238b1e46fe527a854c20f81ff822f8a6361
SHA512 fd3d2a2ef235abd02a9fe5ff50b73b8e47372e8acdd5f54a413c66c7feca42c417f09e0798dfffaed70d54aecd7ab406bb3df0aff4de5bb6eaa7f39e37cfa9bc